rfc: served graph maintenance

docs/rfcs/0011-cli-addressing-and-config.md

@@ -7,7 +7,7 @@ implementation: complete
 authors:
   - OmniGraph maintainers
 created: 2026-06-14
-updated: 2026-10-20
+updated: 2026-10-26
 discussion: null
 supersedes: ["0010"]
 superseded_by: []
@@ -790,3 +790,21 @@ duplicated here.
 - 2026-10-05: `schema apply` is direct-only; the unused served schema-apply
   route is removed. Served changes use cluster deployment. Decision 10 and
   the capability taxonomy now reflect that boundary.
+
+- 2026-10-26: Pending amendment. [Served graph
+  maintenance](2026-10-26-served-graph-maintenance.md), a draft, is the
+  follow-up RFC that Decision 11 calls for. It runs maintenance in the serving
+  process, under explicit budgets, the separate grants `maintain` and
+  `reclaim`, and cancellation; an out-of-band worker becomes an optional
+  stage-only offload that never publishes. Once it is accepted, it supersedes
+  Decision 11's clause "Runs out-of-band (a worker + async job routes, the
+  `POST …` / `GET …/{id}` shape of the bulk-data-plane RFC proposed in [closed
+  PR #219](https://github.com/ModernRelay/omnigraph/pull/219), which never
+  landed in `docs/rfcs/`), never inline in serving" and the implementation
+  note's "remains gated on bulk-data-plane work". Decision 11's direction
+  stands: server-managed, policy-gated, audited, single-coordinator
+  asynchronous jobs, with `direct` retained for break-glass, and `schema plan`
+  stays excluded. That break-glass exists only for local roots: since #1115 the
+  direct CLI accepts local storage only, so a stopped S3 or Azure cluster has
+  no direct maintenance path (#1163), and the draft does not add one. The body
+  stands unchanged until acceptance, which rewrites both sentences.

docs/rfcs/2026-09-29-server-runtime-and-online-deployment.md

@@ -7,7 +7,7 @@ implementation: in-progress
 authors:
   - OmniGraph maintainers
 created: 2026-09-29
-updated: 2026-10-20
+updated: 2026-10-26
 discussion: https://github.com/ModernRelay/omnigraph/pull/799
 supersedes:
   - "0034"
@@ -1655,3 +1655,17 @@ Before enabling an affected increment, its owners must implement and qualify:
   The [HTTP admission decision](2026-09-30-v012-http-admission.md) owns the
   discriminator change and refusal rules; historical decision-log entries retain
   their original release scope. No storage-format change follows from the wire bump.
+
+- 2026-10-26: Pending amendment. [Served graph
+  maintenance](2026-10-26-served-graph-maintenance.md), a draft, delivers
+  increment C's owned maintenance and, in its last phase, adds a per-graph
+  maintenance reconciler that the server's own publications and a timer wake.
+  Its state is a derived hint, re-derived from the manifest before every
+  decision. Once it is accepted, it supersedes the Online deployment sentence
+  "No job queue, background poller or second durable operation record is
+  introduced." for graph maintenance only: the reconciler is a background
+  poller, but no job queue or second durable operation record is added, and a
+  run's status derives from the commits it published. The sentence still holds
+  for deployment, and the Summary's "No new transaction manager,
+  content-recovery log or job queue is added." is unchanged. The body stands
+  unchanged until acceptance, which rewrites the sentence.

docs/rfcs/2026-10-16-graph-access-serving-and-cross-process-writes.md

@@ -7,7 +7,7 @@ implementation: in-progress
 authors:
   - ragnorc
 created: 2026-10-16
-updated: 2026-10-25
+updated: 2026-10-26
 discussion: https://github.com/ModernRelay/omnigraph/pull/1017
 supersedes: []
 superseded_by: []
@@ -1596,3 +1596,18 @@ proposal.
   credentials" for that case only: the rule stays in force for self-hosted
   OIDC servers and every other client, and the launcher's refusal of a managed
   target (the target table and Opening Studio) is unchanged.
+- 2026-10-26: Pending amendment. [Served graph
+  maintenance](2026-10-26-served-graph-maintenance.md), a draft, runs a served
+  root's optimize, cleanup, index rebuild and repair, and PR #1150's `index
+  build`, in the server that holds the cluster lock, through graph-scoped
+  routes, and keeps direct execution for standalone graphs and stopped local
+  clusters. Once it is accepted, it supersedes, for a served root, the
+  commands comment "Physical upkeep, where the storage is" and the
+  declared-exception row "Runs where the storage is" for `repair`, `optimize`,
+  `cleanup` and `index rebuild` in "`init`,
+  `upgrade`, `repair`, `optimize`, `cleanup`, `index rebuild`, `schema plan`
+  and `schema apply` on a direct target, and `cluster validate`, `observe`,
+  `force-unlock` and `upgrade-ledger`". The other operations keep that row.
+  These operations join the operation table, and `cleanup` keeps no MCP tool,
+  a declared exception because reclamation is irreversible. The body
+  stands unchanged until acceptance, which rewrites both sentences.